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Good morning, and thank you for the opportunity to provide input on the CCPA concerning its 
impacts on consumers and the advertising industry, in particular, and the digital economy in 
general. My name is Christopher Oswald, and I am the Senior Vice President of Government 
Relations at the Association of National Advertisers. 

The ANA is the advertising industry’s oldest trade association. ANA’s membership includes 
nearly 2,000 companies, marketing solutions providers, with 25,000 brands that engage almost 
150,000 industry professionals and collectively spend or support more than $400 billion in 
marketing and advertising annually. In California, advertising helps generate $767.7 billion or 
16.4% of the state’s economic activity and helps produce 2.7 million jobs or 16.8% of all jobs in 
the state. Our members include leading marketing data science and technology suppliers, ad 
agencies, law firms, consultants, and vendors. The ANA also counts among its membership a 
large number of nonprofits and charities that are affected by the CCPA, as they use data and 
marketing to reach donors and carry out their missions. Nearly every advertisement you’ll see in 
print, online, or on TV is connected in some way to ANA members’ activities. Many of ANA’s 
members are headquartered in California or carry out significant business in California. 

The ANA strongly supports the underlying goals of the CCPA. Privacy is an extraordinarily 
important value that deserves meaningful protections in the marketplace. As an industry, we’ve 
taken a number of steps to put these values into practice—for instance, providing consumers 
control over data, transparency with respect to the collection, use and transfer of data, and 
implementing strong self-regulatory bodies to ensure accountability in the marketplace. As we 
look closely at the CCPA, however, we are concerned that some aspects of the law, while well- 
intentioned, will have unintended consequences for consumers, businesses, and advertisers that 
will inadvertently undermine rather than enhance consumer privacy. 

The Attorney General plays a critical role in interpreting and clarifying this new law. In doing 
so, we urge the AG to consider clarifying a number of provisions in the law; especially the five 
important issues we highlight today: 

First, Section 1798.125 of the CCPA prohibits businesses from “discriminating” against 
consumers who have exercised their rights under the law unless the activity is “reasonably 
related to the value provided to the consumer.” Our concern is that the “reasonably related to 
the value provided to the consumer” language is not defined, and there is no standard to assess its 
meaning. In addition, it seems quite possible that loyalty discount programs may be considered a 
discriminatory practice under the CCPA since these programs create different price levels 
between consumers - and, therefore, may be prohibited. Consumers who make a deletion request 
or opt-out request will restrict the very data that allows them to participate in a loyalty program. 
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As a result, those consumers who cannot participate will automatically be treated differently than 
other consumers in the loyalty program. This could run afoul of the ambiguous wording in the 
law, which only allows these types of programs when the activity is “reasonably related to the 
value provided to the consumer.” There is nothing in the law that provides guidance on how this 
determination of what is “reasonable” could or should be made. We contend that these loyalty 
programs should not be jeopardized because one, or a few, consumers exercised their rights 
under the law and can no longer participate because a business does not have their data. Loyalty 
programs allow businesses to maintain and foster positive relationships with consumers. They 
provide consumers significant benefits in the form of lower prices and access to special offers. 
Accordingly, the ANA urges the AG to permit a business to offer loyalty-based discount 
programs that consumers value and expect without the program constituting “discrimination” 
under the CCPA. 


Second, Section 1798.115(d) of the CCPA prohibits a company from selling consumer 
personal information that it did not receive directly from the consumer unless the 
consumer has received “explicit notice” and is provided an opportunity to exercise the 
right to opt-out of that sale. Our concern is that the company may have no way to directly 
provide “explicit notice” to the consumer. As such, the company must be able to rely on 
assurances from its data provider that the consumer received proper notice. If not, the online 
advertising ecosystem, which involves multiple parties that may not have direct relationships 
with consumers in order to deliver advertisements, will fall apart. These companies may not be 
able to provide consumers the proper notice, which would prevent them from sharing 
information to deliver advertising. Accordingly, the ANA urges the AG to recognize that a 
written assurance of CCPA compliance is sufficient and reasonable under the circumstances. 

Third, Sections 1798.105 and 1798.120 of the CCPA allow consumers entirely to opt-out of 
the sale of their data or delete their data; but the law does not explicitly permit a business 
to allow a consumer the choice to delete or opt-out regarding some, but not all, of their data. 

The law is not clear on whether consumers can be offered multiple choices related to their 
deletion and opt-out rights, even though consumers may value those additional choices. For that 
reason, the ANA requests that the AG clarify that businesses may offer reasonable options to 
consumers to choose the types of “sales” they want to opt-out of, the types of data they want 
deleted, or to completely opt-out—and not have to just provide an all or nothing option. 

Fourth, Section 1798.110(c) of the CCPA arguably requires a business’ privacy policy to 
disclose to a consumer the “specific pieces of personal information the business has 
collected about that consumer.” Since data differs from one consumer to another, to comply 
with this provision, a business would need to create personalized privacy policies for each 
consumer that visits their website. We do not believe that the Legislature intended this outcome, 
as this would be incredibly burdensome and raises the likelihood of inadvertent disclosures of 
specific consumer information to the wrong recipients. Also, this requirement, confusingly, is 
found in the part of the law describing consumer access rights, which suggests that the provision 
is meant to cover specific consumer requests, not simply anytime the consumer looks at the 
privacy policy. Thus, the ANA asks the AG to clarify that a business does not need to create 
individualized privacy policies for each consumer to comply with the law. 


Fifth, Section 1798.140(o)’s definition of “personal information” is extremely broad and 
includes information that is “capable of being associated with” a “particular consumer or 
household,” which creates tremendous ambiguity around what data is covered by the law. 

There are three issues of importance here: (A) Any data theoretically is “capable of being 
associated with” a particular consumer, which means that there is no reasonable limitation on the 
scope of the law. Without more clarity, businesses may end up deleting or sharing more 
information than is necessary. (B) The use of the term “consumer” in the CCPA arguably could 
include employees and employee data. When a person is acting in the marketplace on behalf of 
their business, the data that is captured is business data, not consumer data. If not corrected, this 
provision would allow employees to access information and potentially compromise confidential 
business information and inappropriately utilize deletion and opt-out rights. (C) Finally, the law 
states that information about a “household” is covered although the term “household” is not 
defined in the law and could lead to information disclosures to the wrong individuals. What is a 
household, and who is included within a household? Are room-mates part of the same 
household? Are grown children part of the same household? For these reasons, the ANA asks 
the AG to clarify: (1) the definition of “personal information” to ensure that the term does not 
cover data that is just theoretically possible of being associated with a consumer or household 
but that is actually or reasonably related to a particular consumer or household; (2) provide 
clarity on the definition of “consumer” so that it does not include employee or other business 
data; and (3) clarify the definition of “household” to provide meaningful and practical guidance 
to consumers and the marketplace. 

Thank you for the opportunity to speak today. The ANA looks forward to submitting detailed 
written comments and working with you as the AG develops implementing regulations for this 
important legislation. To the extent that there are needed changes in the CCPA to protect 
consumer privacy and other important interests that cannot be rectified by this rulemaking, but 
are better suited legislation, we hope the AG will make such recommendations to the California 
Legislature. 


Thank you. 



